program crashes when freeing pointer

[sujinsr]

int xml_validation(char *xsd_file, char *xml_file)
{
    xmlDocPtr doc;
    xmlSchemaPtr schema = NULL;
    xmlSchemaParserCtxtPtr ctxt;
    char *temp_buf = malloc((strlen(xml_file)+1) * sizeof(char));
    char *XMLFileName = malloc((strlen(xml_file)+1) * sizeof(char)); 
    char *XSDFileName = malloc((strlen(xsd_file)+1) * sizeof(char));
    strcpy(XMLFileName, xml_file);
    strcpy(XSDFileName, xsd_file);

    xmlLineNumbersDefault(1);
    ctxt = xmlSchemaNewParserCtxt(XSDFileName);
    xmlSchemaSetParserErrors(ctxt, (xmlSchemaValidityErrorFunc) fprintf, (xmlSchemaValidityWarningFunc) fprintf, stderr);
    schema = xmlSchemaParse(ctxt);
    xmlSchemaFreeParserCtxt(ctxt);
    doc = xmlReadFile(XMLFileName, NULL, 0);

    if (doc == NULL){
        printf("Error : parsing\n");
    }
    else{
        xmlSchemaValidCtxtPtr ctxt;
        int ret = 0;
        ctxt = xmlSchemaNewValidCtxt(schema);
        xmlSchemaSetValidErrors(ctxt, (xmlSchemaValidityErrorFunc) fprintf, (xmlSchemaValidityWarningFunc) fprintf, stderr);
        ret = xmlSchemaValidateDoc(ctxt, doc);
        if (ret == 0){
            strcpy(temp_buf, XMLFileName);
            table(temp_buf);
        }
        xmlSchemaFreeValidCtxt(ctxt);
        xmlFreeDoc(doc);
    }
    xmlSchemaFree(schema);
    xmlSchemaCleanupTypes();
    xmlCleanupParser();
    xmlMemoryDump();

    if(temp_buf != NULL)//
        free(temp_buf);//program crash if i free temp_buf
    if(XMLFileName != NULL)
        free(XMLFileName);
    if(XSDFileName != NULL)
        free(XSDFileName);
    return 0;
}

Above code get the xml and xsd file from function call, validate the xml file with xsd file.
If it valid it will send the xml file to another function to create list..

Problem :
If i free temp_buf program gets crash.
If i not freeing program working fine but memory leak will happen because of malloc.

I trying this in linux using gcc compiler.
please someone correct me.

[MonsieurPointer]

What does table(tmp_buf) in line 30 do? Can you provide the code for that method?

[sujinsr]

table() is the linked list program.

struct element {
    char *hlmid;
    char *hlmname;
    char *hlmstatus;
    int hlmport;
    char *apicount;
    char *rfidcount;
    char *wsncount;
    //int available;
};
struct node {
    char *s_xmlfile;
    char *s_last_mod_time;
    char *s_current_mod_time;
    int local_id;
    struct element s_element;
    struct node *link;
};

void table(char *xml_file) {
    extern struct node *head;
    add_table(&head, xml_file);
    return;
}

void add_table(struct node **headptr, char *xml_file) {
    char *mod_time;
    int option = 0;
    struct node *head, *last, *newnode;
    head = *headptr;
    newnode = malloc(sizeof(struct node));

    while(head != NULL) {
        if(!strcmp(head->s_xmlfile, xml_file)) {
            mod_time = modified_time(head->s_xmlfile );
            if((difftime((time_t)head->s_current_mod_time, (time_t)mod_time)) != 0)
                head->s_current_mod_time = mod_time;
            option = 1;
        }
        head = head->link;
    }
    head = *headptr;
    if(option == 1)
        return;

    mod_time = modified_time( xml_file );
    newnode -> s_xmlfile = xml_file;
    newnode -> s_current_mod_time = mod_time;
    newnode -> s_element.hlmid = NULL;
    newnode -> s_element.hlmname = NULL;
    newnode -> s_element.hlmstatus = NULL;
    newnode -> s_element.apicount= NULL;
    //newnode -> s_last_mod_time = NULL;
    newnode -> s_element.rfidcount = NULL;
    newnode -> s_element.wsncount = NULL;
    newnode -> link = NULL;

    if(head == NULL) {
        head = newnode;
    } else {
        last = head;
        while(last ->link != NULL) {
            last = last -> link;
        }
        last->link = newnode;
    }
    *headptr = head;
}

[MonsieurPointer]

What are the results if you print out the address of temp_buf

1. before calling table(temp_buf)?
2. after calling table(temp_buf)?
3. immediate before free(temp_buf)?

If the adresses are different either at (2) or (3), then that could be the reason why free(temp_buf) causes your program to crash.

[MonsieurPointer]

Oh, I see. Check out line 47:

newnode -> s_xmlfile = xml_file;

Here you are just assigning the address of xml_file (temp_buf) to s_xmlfile; if you free s_xmlfile, then the address of xml_file is no longer valid, therefore causing your program to crash if you free it.
I would recommend either performing a copy of xml_file (using malloc and strcpy), or just free sm_xmlfile, set it to NULL and consequently xml_file to NULL as well. The choice is yours, but I would personally go for the first choice.

[MonsieurPointer]

Well? Did it work?

[sujinsr]

Thanks Monsieur.. you are right..